Overview

overview

10

Static

static

3

SecuriteIn...27.exe

windows7-x64

10

SecuriteIn...27.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SecuriteInfo.com.Win64.PWSX-gen.6289.18727.exe

  • Size

    6.6MB

  • Sample

    240416-t8tlcsgg3s

  • MD5

    7cf0ba422c37585d399e4dffb0b7757c

  • SHA1

    d7b1b39ccdb9287edbae0aa9496ab1d678a4780b

  • SHA256

    b20de9452f77b912c49bd307cc1e2550abb4e17d8497655e64ed0883ce4cfcbe

  • SHA512

    f28f438298954bdabfeb8848dcafe35e074b1750c32e9f01268e41ced8a2acac3e298159b85f159e9c9d4814f73ce2b89c1d8a8afc4a7a2ab30c2258dc3237c1

  • SSDEEP

    196608:2UU5u4Ef30GhXdLPLPCiZMwVnvrgDK+Sshs:Z6FEvHdHC2M8vlEs

Score
10/10
meduzazgratcollectionratstealer

Malware Config

Extracted

Family

meduza

C2

109.107.181.83

Targets

    • Target

      SecuriteInfo.com.Win64.PWSX-gen.6289.18727.exe

    • Size

      6.6MB

    • MD5

      7cf0ba422c37585d399e4dffb0b7757c

    • SHA1

      d7b1b39ccdb9287edbae0aa9496ab1d678a4780b

    • SHA256

      b20de9452f77b912c49bd307cc1e2550abb4e17d8497655e64ed0883ce4cfcbe

    • SHA512

      f28f438298954bdabfeb8848dcafe35e074b1750c32e9f01268e41ced8a2acac3e298159b85f159e9c9d4814f73ce2b89c1d8a8afc4a7a2ab30c2258dc3237c1

    • SSDEEP

      196608:2UU5u4Ef30GhXdLPLPCiZMwVnvrgDK+Sshs:Z6FEvHdHC2M8vlEs

    Score
    10/10
    meduzazgratcollectionratstealer

    • Detect ZGRat V1

    • Meduza

      Meduza is a crypto wallet and info stealer written in C++.

      stealermeduza

    • Meduza Stealer payload

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Deletes itself

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks